Automating Compliance: Surviving NIS2 and Datatilsynet Without Losing Your Mind

It is May 2025. The grace period for the EU's NIS2 directive has evaporated. If you are running infrastructure in Norway, you aren't just worried about uptime anymore; you are worried about personal liability for security negligence. I’ve sat in boardrooms in Oslo where the CTO wasn't asked about feature velocity, but about data sovereignty and audit trails.

The days of manual hardening checklists are dead. If a human has to SSH into a server to secure it, that server is already compromised by human error. In the current threat landscape, where automated botnets scan for vulnerabilities within minutes of a CVE release, manual patching is suicide.

I’m going to show you how to build a self-healing, compliant infrastructure pipeline. We will focus on Ubuntu 24.04 LTS (Noble Numbat), using OpenSCAP for auditing and Ansible for remediation. This isn't theory; this is the exact stack we use to protect high-value financial workloads on CoolVDS.

The "War Story": The Drifting Config

Last year, I audited a fintech startup based in Bjørvika. They had a solid launch strategy, but their infrastructure was a mix of "pet" servers. One developer had manually tweaked the nginx.conf on the production load balancer to fix a header issue during a crunch. Six months later, that undocumented tweak caused a PCI-DSS audit failure because it exposed server version headers and weak ciphers.

They spent three weeks manually retracing steps. We moved them to an immutable infrastructure model on CoolVDS, and the audit time dropped from three weeks to four hours.

Step 1: The Base Layer (Hardware Matters)

Automation is useless if the underlying substrate is compromised. Compliance often requires strict isolation. In a shared hosting environment or a cheap container (LXC/OpenVZ) setup, you share the kernel with neighbors. If they get hit with a kernel panic or a container escape exploit, you fail your audit.

This is why we strictly provision KVM-based NVMe instances at CoolVDS. You need a dedicated kernel. When you run uname -r, you want to see your kernel, not the host's.

Step 2: Automating Hardening with Ansible

Don't configure servers. Describe them. We use Ansible to enforce CIS (Center for Internet Security) benchmarks. Below is a real-world playbook snippet that enforces strict SSH configurations and kernel parameter hardening.

First, ensure your inventory is correct:

[webservers]
192.168.10.55 ansible_user=root

Now, the hardening playbook. This disables root login, enforces key-based auth, and locks down the IP stack.

hardened-server.yml

---
- name: Harden Ubuntu 24.04 for NIS2 Compliance
  hosts: webservers
  become: yes
  vars:
    ssh_port: 22

  tasks:
    - name: Ensure SSH protocol 2 is used
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^Protocol'
        line: 'Protocol 2'
        state: present

    - name: Disable Root Login
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^PermitRootLogin'
        line: 'PermitRootLogin no'
        state: present
        notify: Restart SSH

    - name: Disable Password Authentication
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^PasswordAuthentication'
        line: 'PasswordAuthentication no'
        state: present

    - name: Set strict sysctl parameters for network security
      sysctl:
        name: "{{ item.key }}"
        value: "{{ item.value }}"
        state: present
        reload: yes
      loop:
        - { key: 'net.ipv4.conf.all.accept_redirects', value: '0' }
        - { key: 'net.ipv4.conf.all.send_redirects', value: '0' }
        - { key: 'net.ipv4.conf.default.rp_filter', value: '1' }
        - { key: 'net.ipv4.tcp_syncookies', value: '1' }

  handlers:
    - name: Restart SSH
      service:
        name: sshd
        state: restarted

Run this against your CoolVDS instance:

If you see changed=0, your server is compliant. If it changes something, it means configuration drift occurred and was just fixed automatically.

Step 3: Continuous Auditing with OpenSCAP

Hardening is one thing; proving it to an auditor from Datatilsynet is another. OpenSCAP is the gold standard for this. It scans your system against a defined profile (like CIS or PCI-DSS) and generates an HTML report.

Install the necessary tools on your server:

Once installed, you can list the available profiles for Ubuntu 24.04:

Here is a bash script to run a scan and generate a report. I recommend running this via a cron job every 24 hours.

daily-audit.sh

#!/bin/bash

# Define variables
PROFILE="xccdf_org.ssgproject.content_profile_cis_level2_server"
CONTENT="/usr/share/xml/scap/ssg/content/ssg-ubuntu2404-ds.xml"
REPORT="/var/www/html/audit-reports/report-$(date +%F).html"
RESULTS="/var/log/openscap/results-$(date +%F).xml"

mkdir -p /var/www/html/audit-reports
mkdir -p /var/log/openscap

echo "Starting OpenSCAP Scan: $(date)"

# Run the evaluation
oscap xccdf eval \
  --profile $PROFILE \
  --results $RESULTS \
  --report $REPORT \
  $CONTENT

# Check exit status
if [ $? -eq 2 ]; then
    echo "Non-compliant settings found! Check report at $REPORT"
    # Optional: Send alert to Slack/Teams here
else
    echo "System is compliant."
fi

Pro Tip: Don't just store these reports locally. Use an S3-compatible backend or rsync to ship them to a secure, write-only storage bucket. Auditors love off-site immutable logs.

Step 4: File Integrity Monitoring (FIM)

GDPR requires you to know who accessed personal data and when. If a binary is modified on your system, you need to know immediately. We use Wazuh (an open-source fork of OSSEC) for this. It creates a cryptographic checksum of critical files and alerts on changes.

Install the Wazuh agent:

Here is the critical configuration block for /var/ossec/etc/ossec.conf to monitor your web application and configuration files:

  
  43200

  
  /etc/nginx
  /etc/mysql
  /var/www/html

  
  /var/www/html/cache
  /etc/mtab
  /etc/hosts.deny

Restart the agent to apply:

Why Local Hosting & Latency Matter

When you are running these heavy scanning agents, CPU steal time becomes your enemy. On oversold clouds, running an OpenSCAP scan can spike your CPU usage and trigger throttle limits, slowing down your actual application.

We engineered CoolVDS to avoid this. By capping allocation per physical core, we ensure that your compliance scans don't degrade your user experience. Plus, if your target audience is in Norway, hosting in Oslo means your data stays within the legal jurisdiction, simplifying the "Transfer of Data" clauses in your privacy policy.

Performance Comparison: Scan Impact

The Verdict

Compliance is not a one-time setup; it is a continuous loop of drift detection and remediation. By combining Ansible for enforcement and OpenSCAP for validation, you create a paper trail that satisfies even the strictest auditors.

But software automation needs reliable hardware. Don't let your compliance strategy fail because of noisy neighbors or I/O bottlenecks. Build your fortress on infrastructure designed for the job.

Ready to lock down your infrastructure? Deploy a hardened Ubuntu 24.04 instance on CoolVDS today and pass your next audit with zero stress.